This Privacy Notice establishes the practices and responsibilities of Nova Transportadora do Sudeste S/A – NTS (“NTS”), which demonstrate the commitment to the privacy and protection of your Personal Data, in addition to establishing, in a clear and transparent way, rules on the Processing of Personal Data of Users of the Website http://ri.ntsbrasil.com/, in accordance with the legislation in force.

As a condition of access and use of our Website, you declare that you have read this Privacy Notice fully and attentively, being fully aware of it, conferring your free and express agreement with the terms set forth herein, including the collection of the Personal Data mentioned herein, as well as its use for the purposes specified below.

If you do not agree with the provisions of this Privacy Notice, you should discontinue your access or use of our Website.

Law 13.709 of 08/14/2018 – ”General Data Protection Law“ (”LGPD”)

Law 12.965 of 04/23/2014 – “Civil Rights Framework for the Internet”

For the purposes of this Privacy Notice, the following definitions and abbreviations should be considered for your best understanding:

(I) Anonymization: the use of reasonable technical means available at the time of Processing, whereby data lose the possibility of direct or indirect association with an individual.

(II) ANPD: National Data Protection Authority, established by LGPD as responsible for drafting guidelines for the National Policy on Personal Data Protection and Privacy, as well as to inspect and apply sanctions in case of noncompliance with the legislation, through administrative process.

(III) Consent: free, informed and unequivocal manifestation that authorizes the Processing of Personal Data for a specific purpose.

(IV) Controller: individual or legal entity in charge of the decisions regarding the Processing of Personal Data.

(V) Cookies: small files sent by the Website, saved on the User’s devices, which store the preferences and a few other information, with the purpose of customizing their navigation according to the User’s profile.

(VI) Personal Data (“Datum” or “Data”): includes the concepts of “Personal Data” and “Sensitive Personal Data”.

(VII) Personal Data: information relating to an identified or identifiable individual.

(VIII)Sensitive Personal Data: Personal Data on racial or ethnic origin, religious conviction, political opinion, trade union membership or organization of a religious, philosophical or political nature, data on health or sexual life, genetic or biometric data, when linked to an individual;

(IX) Solely Automated Decision: this is a decision that affects a User that has been programmed to function automatically, without the need for a human operation, based on automated Processing of Personal Data.

(X) Personal Data Processor (”Processor“): individual or legal entity appointed by the Controller (”NTS”) to monitor Data protection compliance and act as a communication channel between the Controller, Data Holders and the National Data Protection Authority.

(XI) IP: abbreviation of Internet Protocol. It is the alphanumeric set that identifies the User’s devices on the Internet.

(XII) Logs: activity logs of any users using the Website.

(XIII) Operator(s): individual or legal entity who performs the Processing of Personal Data on behalf of the Controller.

(XIV) Website: designates the electronic address http://ri.ntsbrasil.com/

(XV) Personal Data Subject (”Subject(s)”): individual to whom the Personal Data that are the object of Processing refer.

(XVI)Data Processing (”Processing”): any operation involving Personal Data, such as those related to the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, destruction, evaluation or control of information, change, communication, transfer, dissemination or extraction;

(XVII) User: any person who accesses and uses the functionalities of the Website http://ri.ntsbrasil.com/.

NTS may collect data, including Personal Data, when you interact with the Website environments, which includes:

Registration Data

Electronic Platform – Access Request Form – Investor Relations – Contact Us – Work With Us

What do we collect?

Full name

Full address

Email

Contact phones

CPF (Individual Taxpayer Registration)

RG (ID Card)

Education Level

Professional Background

Languages

What do we collect for?

(I)To identify and authenticate you.

(II)To comply with obligations arising from the use of our services.

(III)To enroll you in our recruitment processes and selection of candidates.

(IV)To send notice of openings compatible with your profile.

(V)To guarantee the portability of the Data to another Controller of the same branch of our activity, if requested by you, complying with the obligation of art. 18 of the LGPD.

(VI)To expand our relationship, keeping you informed about updates, features, content and other news.

(VII)To enrich your experience and promote our products and services.

Digital Identification Data

What do we collect?

IP Address

Device Identification (ID or IMEI Code)

Browser type

Languages

Click sequence in the website

Time of access and interaction with the website

Cookies

What do we collect for?

(VIII)To identify and authenticate you.

(IX) Comply with legal obligations of record keeping established by the Civil Rights Framework for the Internet – Law 12.965/2014.

(X)To protect you by performing fraud prevention, credit protection and associated risks, as well as compliance with legal and regulatory obligations.

Updating and veracity of the Data. From time to time, we may request the updating of your Personal Registration Data in our relationship base, including name, email, telephone, company and physical address. You are solely responsible for the accuracy, veracity and updating of the Data you provide to NTS. For this, NTS provides a contact channel with the Processor, which you can find in the item on Rights of the Subjects.

Similarly, we are not obligated to process or process any of your Data if there is reason to believe that such treatment or Processing may impute to us any infringement of any applicable law, or if you are using our website for any illegal, unlawful or otherwise unethical purposes.

Personal Data about Third Parties. In some cases, you may provide NTS with Personal Data about Third Parties (such as your customers, executives and employees and dependents). To this end, you necessarily warrant that you have obtained the proper consent of these third parties for this disclosure, including in the case of minors. Within the scope of NTS, such Personal Data will be processed according to this Privacy Notice.

Database. The database formed through the collection of Data is our property and is under our responsibility, and its use, access and sharing, when necessary, will be done within the limits and purposes of the business described in this Privacy Notice.

Technologies employed. We use the technology of Cookies, which are small digital files in text format that are stored on your device (computer, smartphone, tablet etc.) by the internet browser and that store information related to your preferences.

It is up to you to configure your internet browser if you wish to block them. In this case, some features we offer may be limited.

Cookies can be used to observe browsing patterns, mapping which areas of the Website you have visited and your visiting habits as a whole, remembering who you are.

Technology service providers may use their own Cookies on the services, with our permission, to provide services to NTS. Such Cookies may collect your Data on our properties for the purposes provided in this Privacy Notice.

Most browsers are configured to automatically accept Cookies. You can, however, change the settings to Block Cookies or alert you when a cookie is being sent to your device. There are several ways to manage Cookies, being possible to create a general block for Cookies, block Cookies from a specific website and even block third-party Cookies in relation to a website.

Refer to the instructions of your browser to learn more about how to adjust or change your settings, remembering that the desired setting must be replicated on all devices used to access the services (such as computers, smartphones, tablets).

All technologies used will always comply with applicable law and the terms of this Privacy Notice.

We do not use any kind of solely automated decision making that impacts you.

Storage. The information collected by NTS may be stored directly by NTS and/or by NTS service providers.

The collected Data will be stored on our servers located in Brazil, as well as in a resource use environment or cloud servers (cloud computing), which may require a transfer and/or processing of this data outside Brazil.

Duration. Your information is processed and maintained for the minimum period of Data storage established by Brazilian legislation.

Registration Data

STORAGE TERM

5 years after the end of the relationship

LEGAL BASIS

Art. 12 and 34 of the Consumer Protection Code

Digital Identification Data

STORAGE TERM

6 months

LEGAL BASIS

Art. 15, Civil Rights Framework for the Internet

Other data

STORAGE TERM

As long as the relationship lasts and there is no request for erasure or revocation of consent

LEGAL BASIS

Art. 9, Section II of the General Law on the Protection of Personal Data

Longer storage term. For purposes of auditing, security and preservation of rights, NTS may remain with the record history of your Data for longer term than that established by law or regulatory standard.

Information security. NTS keeps all personal data allocated securely and with restricted access, according to its managerial needs and employs all reasonable efforts to ensure the security of its systems in the data custody according to Decree No. 8.771/2016 and the market standard ISF – Information Security Framework 2018, version 7.0.1.

Internally, the Personal Data collected is accessed only by duly authorized professionals, respecting the principles of proportionality, necessity and relevance to the objectives of our business, in addition to the commitment to confidentiality and preservation of your privacy under this Privacy Notice.

External Links. When you use our Website, you may be directed, via link to other websites, which may collect your information and have their own Data Processing Policy.

It is up to you to read the Privacy and Data Processing Policies of such websites outside of our environment, and it is your responsibility to accept or reject them. NTS is not responsible for the Privacy and Data Processing Policies of third parties and the content of any websites other than ours.

Processing by third parties under our guideline. If third-party companies carry out the Processing on our behalf of any Personal Data that we collect, they will respect the conditions stipulated herein and the information security standards, mandatorily.

NTS may transfer and/or share your Personal Data with third parties, provided that the hypothesis of Processing that justified the collection of the Personal Data and the principles of the current legislation are followed. Furthermore, NTS may transfer and/or share your Personal Data with companies of the same NTS business group.

NTS may also share your Personal Data with (I) competent judicial, administrative or governmental authorities, whenever there is a legal determination, request, requisition or court order; and (ii) automatically, in the event of corporate movements, such as merger, acquisition and incorporation.

Any transfer of Personal Data to third parties should be limited to what is strictly necessary to comply with legal obligations or to enable the fulfillment of the purposes presented in this Privacy Notice. Personal Data unnecessary for this purpose will not be transferred.

As a consequence of this transfer, contracted third parties may have access to this information, specifically database managers, companies that control software accessed by NTS in the “Software as a service” (Saas) modality, companies responsible for audits and public authorities that require or need to receive such information, in accordance with the law. NTS requires, through contracts, that contracted third parties comply with current legislation and regulatory standards on the protection of Personal Data.

Anonymization of Data. For the purposes of market intelligence research, disclosure of Data to the press and carrying out advertisements, the data provided by you will be shared in an anonymized form, that is, in a way that does not allow your identification.

Rights. We guarantee you the possibility to update your Personal Data whenever necessary. In addition, as determined by applicable law, you have the right to request: (i) confirmation of the existence of the Processing; (ii) access to your Personal Data; (iii) correction of incomplete, inaccurate or outdated Data; (iv) Anonymization, blocking or deletion of unnecessary, excessive or processed Data in breach of the provisions of the applicable legislation; (v) revocation of your Consent and deletion of the Personal Data; (vi) portability of the Data to another service or product provider; (vii) information regarding the shared use of Personal Data.

Contact with the Processor. Contact with the Processor. If you wish to exercise any of these rights, please contact us through the link.

In accordance with applicable legislation or compliance with a court order, NTS may keep certain of your Personal Data stored for a period of not less than six (6) months after your request for deletion. Such Data will not be anonymized or destroyed by NTS before the end of this period. NTS will store your request for deletion and, subject to the mandatory legal retention period of certain Data, will arrange for the destruction or anonymization, at NTS’s sole discretion, of information capable of identifying you.

If you request the deletion of your information, but still have some obligation pending compliance with NTS, your information will not be deleted and will remain stored for the purpose of making possible the resolution of the pending matter and the adoption of appropriate measures.

In cases where it is not possible to fulfill your request for exclusion, NTS will promptly communicate and justify the refusal to you.

The application of the legal and disciplinary measures mentioned above does not exempt, exempt or mitigate civil, administrative and/or criminal liability for damages resulting from willful or wrongful acts resulting from the violation of current legislation and this Privacy Notice.

Unenforceability. If any point of this Privacy Notice is deemed unenforceable by Data or judicial Authority, the remaining conditions shall remain in full force and effect.

Electronic Communication. You acknowledge that any communication made by e-mail (to the addresses indicated in your registration), SMS, instant communication applications or any other digital form, are also valid, effective and sufficient for the disclosure of any matter that relates to the services we provide, to your data, as well as to the conditions of its provision or to any other matter addressed therein, with the sole exception of what this Privacy Notice provides as such.

Applicable law and jurisdiction. This Privacy Notice will be interpreted according to Brazilian law, in the Portuguese language, being elected the jurisdiction of your domicile to resolve any dispute involving this document, except for specific provision of personal, territorial or functional jurisdiction by applicable law.

If you do not have a domicile in Brazil, and because of the services offered by the Company only in national territory, you will be subject to the Brazilian legislation, agreeing, therefore, that in case of litigation to be resolved, the action should be filed at the District Court of Rio de Janeiro.